I’ve been tracking the same thing and suspect it’s the Kryptex app, which is switching the users hashpower from XMR to Tari a couple of times a day. They seem to wait until the Tari RX difficulty has dropped to the “average” network hashpower, then they double or tripple that for a few hours, grabbing a lot of “easy” blocks, before re-directing the hashpower to other RX targets again.
If you look at The Kryptex Tari Cuckaroo29 (C29) pool, it behaves in a similar way, but out of sync with the RX pool. Sudden bursts of hashpower at low network difficulty, and then off again, probably directed elsewhere.
The Kryptex App (I guess that’s kind of a volunteer botnet) apparently has enough hashpower to “pump” the RX and C29 network difficulty like that, and they probably score a couple of extra cheap blocks for their subscribers.
As Tari grows, that kind of dominance should no longer be possible, and since Kryptex don’t seem to try to dominate the SHA3 and the XMR merge, I doubt they’re doing it for malicious reasons. I think they just found an algorithmic loophole to score some easy blocks while the Tari network is still young.
A funny thing though; that same Kryptex address sometimes finds a solo-mine block, and I can’t help but wonder why they mostly mine for the pool, but sometime solo? Oh, well.
-Memloch